Category Archives: Cyber War

DHS Secret Databases Not Secure, Violations

Posted on by

In part from the report: Recognizing the importance of information security to the economic and national security interests of the United States, the Congress enacted Title III of the E-Government Act of 2002 (Public Law 107-347, Sections 301-305) to improve security within the Federal Government. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Title III of the E-Government Act, as amended, entitled Federal Information Security Management Act of 2002, provides a comprehensive framework to ensure the effectiveness of security controls over information resources that support Federal operations and assets.

Components are not consistently following DHS’ policies and procedures to update the system inventory and plan of action and milestones in the Department’s enterprise management systems. Further, Components continue to operate systems without the proper authority. We also identified a significant deficiency in the Department’s information security program as the United States Secret Service (USSS) did not provide the Chief Information Security Officer (CISO) with the continuous monitoring data required by the Office of Management and Budget (OMB) during Fiscal Year (FY) 2014. Without this information, CISO was significantly restricted from performing continuous monitoring on the Department’s information systems, managing DHS’ information security program, or ensuring compliance with the President’s cybersecurity priorities. Subsequent to the completion of our fieldwork, USSS established an agreement with the DHS Chief Information Officer (CIO) to provide the required data beginning in FY 2015.

Evaluation of DHS Information Security Program for Fiscal Year 2015 revealed the existence of dozens of top-secret unpatched databases.
SecurityAffairs: The story I’m about to tell you is staggering, the US Department of Homeland Security is running dozens of unpatched and vulnerable databases, a number of them contained information rated as “secret” and even “top secret.”
The discovery emerged from the “Evaluation of DHS’ Information Security Program for Fiscal Year 2015” conducted on the department’s IT infrastructure by the US Government.
The audit of the DHS Information Security found serious security issues in the Government systems, including 136 systems that had expired “authorities to operate,” a circumstance that implies the stop of maintenance activities. The principal problem discovered by the inspectors is that a number of systems, despite are still operative and under maintenance have no up-to-date security patches, leaving them open to cyber attacks.


Of the 136 systems, 17 were containing information classified as “secret” or “top secret.”
Giving a deep look at the report on the DHS Information Security Program, it is possible to note that the Coast Guard runs 26 vulnerable databases, followed by FEMA with 25, Customs and Border Protection with 14, and the DHS’ headquarters with 11.

Although Secret Services have only two vulnerable databases, they have failed other targets.
It implemented proper security checks just for 75 percent of its secret or top secret databases, and just 58 per cent of its non-secret databases. The DHS targets are 100 per cent and 75 per cent respectively. The experts discovered several security issues affecting the majority of assessed systems, including PCs, databases and also browsers.
The assessments conducted to evaluate the DHS Information Security Program, revealed several deficiencies in the systems analyzed, for example, Windows 8.1 and Windows 7 workstations which were missing security patches for the principal software.
“We found additional vulnerabilities regarding Adobe Acrobat, Adobe Reader, and Oracle Java software on the Windows 7 workstations,” the department’s inspector general noted in a 66-page report. “If exploited, these vulnerabilities could allow unauthorized access to DHS data.”
The inspectors have found many other security issues in the DHS Information Security Program, including weak passwords, websites susceptible to cross-site and/or cross-frame vulnerabilities and poor security settings.
The Government environments suffer bureaucratic obstacles in bug fixing and patch management, it could take more than a year to fix a leak from the moment it is reported.


The results of the evaluation confirm that improvements have been made but there are a lot of serious issues that have to be urgently addressed.
“While improvements have been made, the Department must ensure compliance with information security requirements in other areas. For example, DHS does not include its classified system information as part of its monthly information security scorecard or its FISMA submission to OMB. In addition, USCG is not reporting its PIV data to the Department, which is a contradiction to the Under Secretary for Management’s guidance that requires Components to submit this information to the Department.5 In addition, we identified deficiencies with DHS’ enterprise management systems, including inaccurate or incomplete data.”
The report also provides a set of recommendations to solve the security issued emerged after the assessment.
The DHS has 90 days to fix the issues, two of which have been already solved.
Pierluigi Paganini

IAEA Just Gave up on Iran Nuclear Verification

Posted on by

Oh my, Barack Obama lied…..not only in verbal form but in written form. Now other world leaders, Saudi Arabia, United Kingdom, France, Israel and more will indeed have some forceful response to Barack Obama.

Then there is the issue of releasing the billions in frozen funds back to Iran and the further lifting of sanctions. But the biggest questions are still not answered: Exactly where is Iran with their nuclear weapons program, does it continue unimpeded and what with other threatened countries do now?

 this deal provides the best possible defense against Iran’s ability to pursue a nuclear weapon covertly — that is, in secret.  International inspectors will have unprecedented access not only to Iranian nuclear facilities, but to the entire supply chain that supports Iran’s nuclear program — from uranium mills that provide the raw materials, to the centrifuge production and storage facilities that support the program.  If Iran cheats, the world will know it.  If we see something suspicious, we will inspect it.  Iran’s past efforts to weaponize its program will be addressed.  With this deal, Iran will face more inspections than any other country in the world. (the full Barack Obama statement here as posted on the White House website)

President Obama sold his nuclear deal with Iran with promises that the accord would be based on “unprecedented verification,” and this week we were reminded of how much that promise was worth. Witness the latest report on Iran’s nuclear program from the International Atomic Energy Agency.

The IAEA is the U.N. outfit that is supposed to monitor Iran’s compliance with the agreement, which requires Tehran to answer the agency’s questions on its past nuclear work in order to obtain sanctions relief. On Wednesday the agency produced its “final assessment”—the finality here having mostly to do with the U.N. nuclear watchdog giving up hope of ever getting straight answers.

Hence we learn that “Iran did not provide any clarification” regarding experiments the agency believes it conducted on testing components of nuclear components at its military facility at Parchin. “The information available to the Agency, including the results of the sampling analysis and the satellite imagery, does not support Iran’s statements on the purpose of the building,” says the report. “The Agency assesses that the extensive activities undertaken by Iran since February 2012 at the particular location of interest to the Agency seriously undermined the Agency’s ability to conduct effective verification.”

This seems to be A-OK with the Obama Administration, which made clear it’s prepared to accept any amount of Iranian stonewalling in order to move ahead with sanctions relief. “We had not expected a full confession, nor did we need one,” an unnamed senior Administration official told the Journal. One wonders why they even bothered with the charade.

Still, the report is illuminating on several points, above all its conclusion that Tehran continued to work on nuclear weapons research until 2009. That further discredits the 2007 National Intelligence Estimate, which claimed Iran’s weapons program had ceased in 2003, and which effectively ended any chance that the Bush Administration would use military force against Iran’s nuclear sites.

It should also inspire some humility about the quality of Western intelligence regarding closed and hostile regimes such as Iran’s. A 2014 report from the Pentagon’s Defense Science Board noted that at “levels associated with small or nascent [nuclear] programs, key observables are easily masked.” Yet the Administration keeps insisting that Iran’s nondisclosures don’t matter because the U.S. has “perfect knowledge” of what the mullahs are up to, as John Kerry claimed last summer.

The larger point is that the nuclear deal has already become a case of Iran pretending not to cheat while the West pretends not to notice. That may succeed in bringing the agreement into force, but it offers no confidence that Iran won’t eventually build its weapon.

ISIS in America, Retweets to Raqqa

Posted on by

ISIS in America    Read the full study here.

IT IS APPARENT that the U.S. is home to a small but active cadre of individuals infatuated with ISIS’s ideology, some of whom have decided to mobilize in its furtherance.

This section attempts to provide an overview of this demographic by drawing on research that attempted to reconstruct the lives—both real and virtual—of U.S.-based ISIS supporters. The research effort was based on legal documents, media reports, social media monitoring, and interviews with a variety of individuals, though there were at times limitations to both the amount and reliability of publicly available information.

 

The 71 individuals charged for ISIS-related activities (as of November 12, 2015)

 

ƒ.WHILE NOT AS LARGE as in many other Western countries, ISIS-related mobilization in the United States has been unprecedented. As of the fall of 2015, U.S. authorities speak of some 250 Americans who have traveled or attempted to travel to Syria/Iraq to join the Islamic State in Iraq and Syria (ISIS) and 900 active investigations against ISIS sympathizers in all 50 states.

ƒ. Seventy-one individuals have been charged with ISIS-related activities since March 2014. Fifty-six have been arrested in 2015 alone, a record number of terrorism-related arrests for any year since 9/11. Of those charged:

‚. The average age is 26.

‚. 86% are male.

‚. Their activities were located in 21 states.

‚. 51% traveled or attempted to travel abroad.

‚. 27% were involved in plots to carry out attacks on U.S. soil.

‚. 55% were arrested in an operation involving an informant and/or an undercover agent.

ƒ. A small number of Americans have been killed in ISIS-related activities: three inside the U.S., at least a dozen abroad.

ƒ. The profiles of individuals involved in ISIS-related activities in the U.S. differ widely in race, age, social class, education, and family background. Their motivations are equally diverse and defy easy analysis.

ƒ. Social media plays a crucial role in the radicalization and, at times, mobilization of U.S.-based ISIS sympathizers.

The Program on Extremism has identified some 300 American and/or U.S.-based ISIS sympathizers active on social media, spreading propaganda, and interacting with like-minded individuals. Some members of this online echo chamber eventually make the leap from keyboard warriors to actual militancy.

ƒ. American ISIS sympathizers are particularly active on Twitter, where they spasmodically create accounts that often get suspended in a never-ending cat-and-mouse game. Some accounts (the “nodes”) are the generators of primary content, some (the “amplifiers”) just retweet material, others (the “shout-outs”) promote newly created accounts of suspended users.

ƒ. ISIS-related radicalization is by no means limited to social media. While instances of purely web-driven, individual radicalization are numerous, in several cases U.S.-based individuals initially cultivated and later strengthened their interest in ISIS’s narrative through face-to-face relationships. In most cases online and offline dynamics complement one another.

ƒ. The spectrum of U.S.-based sympathizers’ actual involvement with ISIS varies significantly, ranging from those who are merely inspired by its message to those few who reached mid-level leadership positions within the group.

 

US Admits Iran Will Punk the World on the JPOA

Posted on by

The US never really expected Iran to come totally clean about a key element of its nuclear program

 BusinessInsider: The Iran nuclear deal will clear a crucial milestone on December 15, when the International Atomic Energy Agency submits a report on the extent of Iran’s previous nuclear-weaponization activities.

The completion of that investigation into the possible military dimensions (PMDs) of Iran’s nuclear program is one of the major prerequisites for the full implementation of the Joint Comprehensive Plan of Action (JCPOA), the landmark nuclear deal that Iran and a US-led group of six countries signed in July.

iran nuclearREUTERS

In theory, the JCPOA won’t be implemented unless Iran complies with a separate “roadmap” agreement with the IAEA. That agreement, which was signed the same day as the JCPOA, lays out the parameters of the agency’s weaponization investigation. The JCPOA isn’t supposed to go into effect unless the sides “fully implement” that roadmap agreement.

But “full implementation” doesn’t really have a fixed meaning within the JCPOA, an agreement that is voluntary and non-binding. And according to an Associated Press analysis out Monday, the IAEA’s investigation is likely going to have inconclusive results.

As the AP notes, the head of the IAEA has “been careful to diminish expectations, describing his upcoming report last week as ‘not black and white.'” And according to the AP, Iranian officials have spoken about the IAEA probe using similar language, “suggesting they already know that the agency’s conclusions won’t be damning.”

Iran has already threatened that it simply won’t comply with the JCPOA if it’s dissatisfied with the IAEA’s report. That might be more than just an empty ultimatum, since according to the AP the announcement is consistent with what Iranian diplomats are saying behind closed doors as well.

“Two Western diplomats familiar with the issue say those same threats have been made in negotiations with IAEA officials,” the AP reported.

The weaponization report is considered crucial to the successful implementation of the nuclear deal, as it will be used to formulate an inspection baseline for Iran’s nuclear program. There is extensive evidence that Iran had a nuclear weapons program until as late as 2003.  The IAEA needs to be able to identify key personnel, facilities, supply chains, and past activities to establish exactly how far along Iran’s weaponization activities really are and to recognize whether those activities have been restarted.

But as the AP’s analysis suggests, the roadmap is also contentious — and perhaps even inconvenient, given its potential to interrupt the smooth implementation of a deal that Iran and the US-led group spent nearly two years negotiating. There are already signs that the US wants to get past the investigation as smoothly as possible — even if the IAEA’s “roadmap” doesn’t result in Iran’s full disclosure of its past weaponization work.

Business Insider has obtained a State Department document submitted to congressional offices during the Congress’s review of the JCPOA in July.

The 18-page document, a “verification assessment report” that is essentially the department’s outline of the nuclear deal’s various stipulations, is unclassified. But congressional staffers were only allowed to read it inside of a SCIF, or a special area for viewing and storing classified or compartmentalized information.

The section entitled “Addressing ‘Possible Military Dimensions'” discusses the US’ interpretation of the IAEA “roadmap” and its requirements.

“Iran’s implementation of its commitments under the Roadmap will bring to an end the years-long delay in the IAEA’s ability to address PMD [Possible Military Dimensions] issues,” the document reads.

Two paragraphs later, it explains that even with this high level of confidence that the IAEA investigation will resolve the PMD issue, the US’ standards fall somewhat short of full Iranian disclosure on weaponization-related matters.

“An Iranian admission of its past nuclear weapons program is unlikely and is not necessary for purposes of verifying JCPOA commitments going forward,” the report reads. “US confidence on this front is based in large part on what we believe we already know about Iran’s past activities”

“The United States has shared with the IAEA relevant information, and crafted specific JCPOA measures that will enable inspectors to establish confidence that previously reported Iranian PMD activities are not ongoing,” it continued. “If credible information becomes available regarding any renewed Iranian efforts, it would be shared with the IAEA as appropriate, whether involving previous people, locations, entities, or otherwise. We believe other IAEA member states will do the same.”

This report was circulated in Congress not long after the deal was signed. From a relatively early stage, the State Department believed that the IAEA was capable of monitoring Iran’s nuclear program without Iran fully disclosing its past activities.

This wasn’t because of any particular US trust in the Iranians. Rather, it was due to State’s confidence that US intelligence already knew enough about the extent of Iran’s weaponization program to make such an admission of past weaponization work unnecessary.

Even so, State apparently never expected full Iranian transparency on weaponization. And the Obama administration believed that Iran had no responsibility to admit to a past weaponization program under the JCPOA.

Washington always intended to give Iran a pass on full disclosure — and the result may be a watered-down IAEA investigation that’s treated more as a formality than as an integral element of an arms control agreement designed to last for decades.

The United States has it’s own Task Force, that is IF the White House allows full technology to monitor Iran.

Task Force to assess technologies in support of future arms control and nonproliferation treaties and agreements. The Task Force, however, quickly realized that addressing this charge alone would be of limited value without considering a broader context for nuclear proliferation into the foreseeable future. That realization resulted from a number of factors which included:

 Accounts of rogue state actions and their potential cascading effects;

 The impact of advancing technologies relevant to nuclear weapons development;

 The growing evidence of networks of cooperation among countries that would otherwise have

little reason to do so;

 The implications of U.S. policy statements to reduce the importance of nuclear weapons in international affairs, accompanied by further reductions in numbers, which are leading some longtime allies and partners to entertain development of their own arsenals;

 The wide range of motivations, capabilities, and approaches that each potential proliferator introduces.

 

Newest Emails Released, Hillary Told She Rocked

Posted on by

Some samples of the recent released emails are here. Additional summaries are here.

An exchange with Sid-vicious Blumenthal, in the emails where it is suggested that investigative author Bob Woodward is an FBI asset?

 

Embedded image permalink

Embedded image permalink

 

FNC: As the number of classified Hillary Clinton emails grew to nearly 1,000, they also reveal how freely she and her staff shared information on the Benghazi attacks, including confirming the death of Ambassador Chris Stevens – and even celebrating her controversial hearing appearance where she asked, “What difference, at this point, does it make” what led to the attacks.

The emails were part of the largest release yet of Clinton documents from the State Department.

The batch contained 328 emails deemed to have classified information. According to the State Department, that brings the total number with classified information to 999.

That alone drew outrage from Republicans, with the RNC saying the sheer number of emails with classified material “underscores the degree to which Hillary Clinton jeopardized our national security and has tried to mislead the American people.”

But the document dump also potentially creates more problems for Clinton in her attempt to move past the fallout from the Benghazi attacks.

Notably, the emails show her aides congratulating her after her initial January 2013 testimony on the attacks before Congress. During that hearing, she got into a dispute with Sen. Ron Johnson, R-Wis., over the conflicting narratives about the motivation for the attack and what preceded it – the State Department had come under fire for initially pointing to a protest over an anti-Islam film. Clinton told Johnson, expressively, “what difference, at this point, does it make?”

During and after the hearing, aides forwarded Clinton congratulatory messages.

“I’m being flooded with emails about how you rocked,” deputy chief of staff Huma Abedin wrote. “And you looked fabulous.” One supporter wrote a message with the subject line: “twitterverse abuzz with Hillary-kvelling,” using the Yiddish word for gushing praise.

Later, though, political consultant Mark Penn sent an email to Clinton gently suggesting that perhaps it wasn’t wise to lose her temper in the hearing. Penn suggested Republicans could use that moment as evidence that they had rattled her.

Aide Philippe Reines leaped to Clinton’s defense, writing:

“Give Me A Break. You did not look rattled. You looked real. There’s a difference. A big one.”

The emails from September 2012 also show her and her staff scrambling to respond the night of the attacks and later calibrating their public response.

On the night of the attacks, the communications show Clinton notifying top advisers of confirmation from the Libyans that then-Ambassador Stevens had died.

Early the next morning, Chief of Staff Cheryl Mills tells Clinton they “recovered both bodies” and were looking to get out a statement; Sean Smith, information management officer, was the other State Department employee killed that night.

After a controversy erupted over claims the attack was “spontaneous,” aide Jake Sullivan wrote to Clinton to assure her, “You never said spontaneous or characterized the motives. In fact you were careful in your first statement to say we were assessing motive and method. The way you treated the video in the Libya context was to say that some sought to *justify* the attack on that basis.”

Further, the emails show that shortly before 9 p.m. on Sept. 11, 2012, Clinton sent an email asking her daughter to call her at her office about the attack on the U.S. consulate in Benghazi, Libya. The email was addressed to an account under the name “Diane Reynolds,” an alias Chelsea Clinton used for personal messages.

“Two of our officers were killed in Benghazi by an al-Qaida-like group: The Ambassador, whom I handpicked, and a young communications officer on temporary duty w(ith) a wife and two young children,” Hillary Clinton later wrote to her daughter. “Very hard day and I fear more of the same tomorrow.”

In October, that email was trumpeted by Republicans on the House Benghazi committee as evidence that Clinton knew very quickly the attack on the consulate was the work of Islamic terrorists, not a spontaneous street protest triggered by the release of a video considered an insult to the Prophet Mohammed.

Another exchange from early 2013 shows retired diplomat James Jeffrey appearing to do damage control over a Washington Post piece from him titled, “How to Prevent the Next Benghazi.”

Jeffrey starts the conversation by warning Mills he’d been contacted by the Post regarding his views and reluctantly agreed to comply. He warns it would be posted and “you may see this piece as critical of expeditionary diplomacy. It’s not; I’ve risked my life practicing it. But having lost over 100 personnel KIA and WIA (and two ARBs judging me) in my time in Iraq (and a son going back to Afghanistan on Department assignment this summer) I feel very strongly that we have to be prudent. If the media ask me if there is any daylight between me and you all I will cite the Pickering Mullen ARB and the Secretary’s testimony and say absolutely not.”

Forwarding the article, he adds, “(Title is not what I gave them and stupid as I state explicitly at the end that being in Benghazi was the right policy call).”